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Amendments to the Claims : 

The listing of claims will replace all prior versions, and listings, of claims 

in the application: 
Listing of Claims : 

1. (Currently amended) A method for selectively shadowing only 
accesses to external storage media connected to a computer, the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium; wherein the detecting step comprises intercepting an I/O request from 
the computer to an external storage media drive in which the external storage 
media is inserted . 

2. (Previously presented) The method of claim 1 wherein the access is a 
write operation. 

3. (Previously presented) The method of claim 1 wherein the access is a 
read operation. 

4. (Canceled) 

5. (Currently amended) The method of claim [4] 5 wherein the I/O 
request is one of the group consisting of a file open or creation request, a write 
request, a file close request, a file system control request and a read request. 

6. (Previously presented) The method of claim 5 further comprising: 
providing a proxy handler for the I/O request; and executing the proxy handler, 
in response to the detecting step. 
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7. (Currently amended) The method of claim [4] 1 wherein the computer 
runs under a Windows an operating system and the I/O request is one of the 
group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE, 
IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets. 

8. (Previously presented) The method of claim 7 further comprising: 
providing proxy handlers for the IRPJM J_CR E ATE , IRP_MJ_WRITE, 
IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONT- ROL packets; and 
executing one of the proxy handlers, in response to the detecting step when the 
I/O request is a respective packet selected from the group consisting of 
IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and 
IRP_MJ_FILE_SYSTEM_CONTROL packets. 

9. (Previously presented) The method of claim 8 further comprising: 
providing a proxy handlers for the IRP_MJ_READ packet; and executing the 
proxy handlers for the IRP_MJ_READ packet, in response to the detecting step 
when the I/O request is an IRP_MJ_READ packet. 

10. (Previously presented) The method of claim 1 wherein the storage 
location other than the external storage media is a protected storage location. 

11. (Previously presented) The method of claim 1 further comprising: 
writing the data to the external storage medium after the step of writing a copy 
of the data to a storage location other than the external storage medium. 

12. (Previously presented) The method of claim 1 further comprising: 
attaching to one or more file systems connected to an external storage media 
drive in which the external storage medium is inserted; and wherein the 
detecting step comprises intercepting I/O requests to the one or more file 
systems. 
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13. (Previously presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a CD, a 
removable hard disk drive, and a zip disk drive. 

14. (Previously presented) The method of claim 1 further comprising: 
collecting the copy into a database where similar copies are collected; and 
querying the database. 

15. (Previously presented) The method of claim 14 wherein the database 
comprises records, each record comprising the copied data, a file name associated 
with the data, an identification of who initiated the data access, a station ID, and 
when the access was made. 

16. (Previously presented) The method of claim 14 wherein the computer is 
connected to a computer network, and the detecting and copying steps are 
performed at the computer, and the collecting and querying steps are performed 
at another computer on the network. 

17. (Previously presented) The method of claim 14 wherein the collecting 
and querying steps are performed by a user with administrator privileges. 

18. (Currently amended) A computer readable medium on which is 
embedded computer software, the software performing a method, the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium; wherein the detecting step comprises intercepting an I/O request from 
the computer to an external storage media drive in which the external storage 
media is inserted. 
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19. (Previously presented) The computer readable medium of claim 18 
wherein the access is a write operation. 

20. (Canceled) 

21. (Currently amended) The computer readable medium of claim 20 18 
wherein the computer system runs under a Windows an operating system and 
the I/O request is one of the group consisting of IRP_MJ_CREATE, 
IRP_MJ_WRITE, IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and 
IRP__MJ_READ packets. 

22. (Currently amended) An apparatus for selectively shadowing only 
accesses to external storage media connected to a computer, the apparatus 
comprising: a detector that receives intercepts I/O requests to an external 
storage medium from the computer to an external storage media drive in which 
the external storage media is inserted ; and a storage, other than the external 
storage medium, connected to the detector, in which a copy of the accessed data 
is written. 

23. (Previously presented) The apparatus of claim 22 further comprising 
one or more proxy handlers connected to the detector, wherein the proxy 
handlers handle certain I/O requests. 

24. (Previously presented) The apparatus of claim 23 wherein the certain 
I/O requests comprise IRP_MJ_CREATE, IRPJMJ_ WRITE, IRP_MJ_CLOSE 
and IRP_MJ_FILE_SYSTEM_CONTROL packet. 

25. (Previously presented) The apparatus of claim 24 wherein the certain 
I/O requests further comprise an IRP MJ READ packet. 
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26. (Previously presented) The apparatus of claim 23 further comprising: a 
list, connected to at least some of the one or more proxy handlers, in which file 
identifiers are contained. 

27. (Previously presented) The apparatus of claim 26 wherein the file 
identifiers are IRP.Fs Context values. 

28. (Previously presented) The apparatus of claim 23 further comprising: 
one or more counters, connected to at least some of the one or more proxy 
handlers, by which certain file operations are counted. 

29. (Currently amended) The apparatus of claim 23 wherein the computer 
runs under a Windows an operating system, and the one or more proxy handlers 
are connected to I/O request packet drivers supplied by the operating system. 

30. (Canceled) 

31. (New) The method of claim 1 wherein the external storage medium is 
selected from the group consisting of a floppy disk; a writable CD, a removable 
hard disk drive, and a zip disk drive. 

32. (New) The computer readable medium of claim 18 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 

33. (New) The apparatus of claim 22 wherein the external storage medium is 
selected from the group consisting of a floppy disk; a writable CD, a removable 
hard disk drive, and a zip disk drive. 



